OpenWrt 18.06 - python-cryptography fails due to Python2.7.1.7

[BKPepe]

Maintainers: @jefferyto, @commodo
Environment: OpenWrt 18.06, all Turris routers (aarch64_cortex-a53, arm_cortex-a9_vfpv3 and powerpc_8540)

Description:

After we updated Python2 to version python 2.7.17 in the stable branch, locally neither our build server can not compile python-cryptography. When I reverted the update, it works. It seems that this patch pyca/cryptography#4234 should solve it. It doesn't apply and I'm trying to fix failed hunks.

Here is my output:

building '_openssl' extension
ccache_cc -fno-strict-aliasing -O2 -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/hostpkg/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/target-powerpc_8540_musl/host/include -DNDEBUG -g -O3 -Wall -Wstrict-prototypes -O2 -pipe -mcpu=8540 -fno-caller-saves -fno-plt -fhonour-copts -Wno-error=unused-but-set-variable -Wno-error=unused-result -msoft-float -iremap/home/pepe/work/turrisos/turris1x-hbk/build/build_dir/target-powerpc_8540_musl/python-cryptography-2.1.4:python-cryptography-2.1.4 -Wformat -Werror=format-security -fstack-protector -D_FORTIFY_SOURCE=1 -Wl,-z,now -Wl,-z,relro -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/target-powerpc_8540_musl/usr/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/target-powerpc_8540_musl/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/toolchain-powerpc_8540_gcc-7.3.0_musl/usr/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/toolchain-powerpc_8540_gcc-7.3.0_musl/include/fortify -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/toolchain-powerpc_8540_gcc-7.3.0_musl/include -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/target-powerpc_8540_musl/usr/include/python2.7 -fPIC -I/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/target-powerpc_8540_musl/usr/include/python2.7 -c build/temp.linux2-2.7/_openssl.c -o build/temp.linux2-2.7/build/temp.linux2-2.7/_openssl.o -Wconversion -Wno-error=sign-conversion
build/temp.linux2-2.7/_openssl.c: In function 'SSL_SESSION_get_master_key':
build/temp.linux2-2.7/_openssl.c:2202:23: warning: conversion to 'size_t {aka unsigned int}' from 'int' may change the sign of the result [-Wsign-conversion]
         return session->master_key_length;
                ~~~~~~~^~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2204:18: warning: conversion to 'size_t {aka unsigned int}' from 'int' may change the sign of the result [-Wsign-conversion]
         outlen = session->master_key_length;
                  ^~~~~~~
build/temp.linux2-2.7/_openssl.c: At top level:
build/temp.linux2-2.7/_openssl.c:2342:6: error: conflicting types for 'X509_get0_signature'
 void X509_get0_signature(ASN1_BIT_STRING **psig, X509_ALGOR **palg,
      ^~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96:0,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:919:6: note: previous declaration of 'X509_get0_signature' was here
 void X509_get0_signature(const ASN1_BIT_STRING **psig,
      ^~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2476:7: error: 'X509_VERIFY_PARAM_set1_host' redeclared as different kind of symbol
 int (*X509_VERIFY_PARAM_set1_host)(X509_VERIFY_PARAM *, const char *,
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:564:5: note: previous declaration of 'X509_VERIFY_PARAM_set1_host' was here
 int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, const char *name,
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2478:7: error: 'X509_VERIFY_PARAM_set1_email' redeclared as different kind of symbol
 int (*X509_VERIFY_PARAM_set1_email)(X509_VERIFY_PARAM *, const char *,
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:571:5: note: previous declaration of 'X509_VERIFY_PARAM_set1_email' was here
 int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,  const char *email,
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2480:7: error: 'X509_VERIFY_PARAM_set1_ip' redeclared as different kind of symbol
 int (*X509_VERIFY_PARAM_set1_ip)(X509_VERIFY_PARAM *, const unsigned char *,
       ^~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:573:5: note: previous declaration of 'X509_VERIFY_PARAM_set1_ip' was here
 int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *param, const unsigned char *ip,
     ^~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2482:7: error: 'X509_VERIFY_PARAM_set1_ip_asc' redeclared as different kind of symbol
 int (*X509_VERIFY_PARAM_set1_ip_asc)(X509_VERIFY_PARAM *, const char *) = NULL;
       ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:575:5: note: previous declaration of 'X509_VERIFY_PARAM_set1_ip_asc' was here
 int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2483:8: error: 'X509_VERIFY_PARAM_set_hostflags' redeclared as different kind of symbol
 void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *,
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:568:6: note: previous declaration of 'X509_VERIFY_PARAM_set_hostflags' was here
 void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:2522:7: error: conflicting types for 'X509_OBJECT_get0_X509'
 X509 *X509_OBJECT_get0_X509(X509_OBJECT *x) {
       ^~~~~~~~~~~~~~~~~~~~~
In file included from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509.h:595:0,
                 from /home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/engine.h:96,
                 from build/temp.linux2-2.7/_openssl.c:577:
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/x509_vfy.h:430:7: note: previous declaration of 'X509_OBJECT_get0_X509' was here
 X509 *X509_OBJECT_get0_X509(const X509_OBJECT *xo);
       ^~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_setup_ssl_threads':
build/temp.linux2-2.7/_openssl.c:2619:28: warning: conversion to 'unsigned int' from 'int' may change the sign of the result [-Wsign-conversion]
         _ssl_locks_count = CRYPTO_num_locks();
                            ^~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function 'Cryptography_pem_password_cb':
build/temp.linux2-2.7/_openssl.c:2652:35: warning: conversion to 'size_t {aka unsigned int}' from 'int' may change the sign of the result [-Wsign-conversion]
         memcpy(buf, st->password, st->length);
                                   ^~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_DTLS_client_method':
build/temp.linux2-2.7/_openssl.c:23964:10: warning: implicit declaration of function 'DTLS_client_method'; did you mean 'TLS_client_method'? [-Wimplicit-function-declaration]
   return DTLS_client_method();
          ^~~~~~~~~~~~~~~~~~
          TLS_client_method
build/temp.linux2-2.7/_openssl.c:23964:10: warning: return makes pointer from integer without a cast [-Wint-conversion]
   return DTLS_client_method();
          ^~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_DTLS_client_method':
build/temp.linux2-2.7/_openssl.c:23974:12: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
   { result = DTLS_client_method(); }
            ^
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_DTLS_method':
build/temp.linux2-2.7/_openssl.c:23988:10: warning: implicit declaration of function 'DTLS_method'; did you mean 'TLS_method'? [-Wimplicit-function-declaration]
   return DTLS_method();
          ^~~~~~~~~~~
          TLS_method
build/temp.linux2-2.7/_openssl.c:23988:10: warning: return makes pointer from integer without a cast [-Wint-conversion]
   return DTLS_method();
          ^~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_DTLS_method':
build/temp.linux2-2.7/_openssl.c:23998:12: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
   { result = DTLS_method(); }
            ^
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_DTLS_server_method':
build/temp.linux2-2.7/_openssl.c:24012:10: warning: implicit declaration of function 'DTLS_server_method'; did you mean 'TLS_server_method'? [-Wimplicit-function-declaration]
   return DTLS_server_method();
          ^~~~~~~~~~~~~~~~~~
          TLS_server_method
build/temp.linux2-2.7/_openssl.c:24012:10: warning: return makes pointer from integer without a cast [-Wint-conversion]
   return DTLS_server_method();
          ^~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_DTLS_server_method':
build/temp.linux2-2.7/_openssl.c:24022:12: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
   { result = DTLS_server_method(); }
            ^
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_add_extra_chain_cert':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1200:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:47707:10: note: in expansion of macro 'SSL_CTX_add_extra_chain_cert'
   return SSL_CTX_add_extra_chain_cert(x0, x1);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_add_extra_chain_cert':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1200:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509)
  ^
build/temp.linux2-2.7/_openssl.c:47747:14: note: in expansion of macro 'SSL_CTX_add_extra_chain_cert'
   { result = SSL_CTX_add_extra_chain_cert(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_clear_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:573:44: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
                                            ^
build/temp.linux2-2.7/_openssl.c:47796:10: note: in expansion of macro 'SSL_CTX_clear_options'
   return SSL_CTX_clear_options(x0, x1);
          ^~~~~~~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:573:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:47796:10: note: in expansion of macro 'SSL_CTX_clear_options'
   return SSL_CTX_clear_options(x0, x1);
          ^~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_clear_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:573:44: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
                                            ^
build/temp.linux2-2.7/_openssl.c:47829:14: note: in expansion of macro 'SSL_CTX_clear_options'
   { result = SSL_CTX_clear_options(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:573:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
  ^
build/temp.linux2-2.7/_openssl.c:47829:14: note: in expansion of macro 'SSL_CTX_clear_options'
   { result = SSL_CTX_clear_options(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_get_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:588:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:48081:10: note: in expansion of macro 'SSL_CTX_get_mode'
   return SSL_CTX_get_mode(x0);
          ^~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_get_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:588:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)
  ^
build/temp.linux2-2.7/_openssl.c:48104:14: note: in expansion of macro 'SSL_CTX_get_mode'
   { result = SSL_CTX_get_mode(x0); }
              ^~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_get_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:575:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:48117:10: note: in expansion of macro 'SSL_CTX_get_options'
   return SSL_CTX_get_options(x0);
          ^~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_get_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:575:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)
  ^
build/temp.linux2-2.7/_openssl.c:48140:14: note: in expansion of macro 'SSL_CTX_get_options'
   { result = SSL_CTX_get_options(x0); }
              ^~~~~~~~~~~~~~~~~~~
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_get_session_cache_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1521:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:48153:10: note: in expansion of macro 'SSL_CTX_get_session_cache_mode'
   return SSL_CTX_get_session_cache_mode(x0);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_get_session_cache_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1521:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_GET_SESS_CACHE_MODE,0,NULL)
  ^
build/temp.linux2-2.7/_openssl.c:48176:14: note: in expansion of macro 'SSL_CTX_get_session_cache_mode'
   { result = SSL_CTX_get_session_cache_mode(x0); }
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_set_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:584:35: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)
                                   ^
build/temp.linux2-2.7/_openssl.c:49637:10: note: in expansion of macro 'SSL_CTX_set_mode'
   return SSL_CTX_set_mode(x0, x1);
          ^~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:584:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:49637:10: note: in expansion of macro 'SSL_CTX_set_mode'
   return SSL_CTX_set_mode(x0, x1);
          ^~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_set_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:584:35: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)
                                   ^
build/temp.linux2-2.7/_openssl.c:49670:14: note: in expansion of macro 'SSL_CTX_set_mode'
   { result = SSL_CTX_set_mode(x0, x1); }
              ^~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:584:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)
  ^
build/temp.linux2-2.7/_openssl.c:49670:14: note: in expansion of macro 'SSL_CTX_set_mode'
   { result = SSL_CTX_set_mode(x0, x1); }
              ^~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_set_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:571:38: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
                                      ^
build/temp.linux2-2.7/_openssl.c:49801:10: note: in expansion of macro 'SSL_CTX_set_options'
   return SSL_CTX_set_options(x0, x1);
          ^~~~~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:571:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:49801:10: note: in expansion of macro 'SSL_CTX_set_options'
   return SSL_CTX_set_options(x0, x1);
          ^~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_set_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:571:38: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
                                      ^
build/temp.linux2-2.7/_openssl.c:49834:14: note: in expansion of macro 'SSL_CTX_set_options'
   { result = SSL_CTX_set_options(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:571:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
  ^
build/temp.linux2-2.7/_openssl.c:49834:14: note: in expansion of macro 'SSL_CTX_set_options'
   { result = SSL_CTX_set_options(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_set_session_cache_mode':
build/temp.linux2-2.7/_openssl.c:49847:45: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
   return SSL_CTX_set_session_cache_mode(x0, x1);
                                             ^
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1519:48: note: in definition of macro 'SSL_CTX_set_session_cache_mode'
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)
                                                ^
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1519:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:49847:10: note: in expansion of macro 'SSL_CTX_set_session_cache_mode'
   return SSL_CTX_set_session_cache_mode(x0, x1);
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_set_session_cache_mode':
build/temp.linux2-2.7/_openssl.c:49880:49: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
   { result = SSL_CTX_set_session_cache_mode(x0, x1); }
                                                 ^
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1519:48: note: in definition of macro 'SSL_CTX_set_session_cache_mode'
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)
                                                ^
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1519:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_SESS_CACHE_MODE,m,NULL)
  ^
build/temp.linux2-2.7/_openssl.c:49880:14: note: in expansion of macro 'SSL_CTX_set_session_cache_mode'
   { result = SSL_CTX_set_session_cache_mode(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_set_tmp_dh':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1152:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:50196:10: note: in expansion of macro 'SSL_CTX_set_tmp_dh'
   return SSL_CTX_set_tmp_dh(x0, x1);
          ^~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_set_tmp_dh':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1152:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH,0,(char *)dh)
  ^
build/temp.linux2-2.7/_openssl.c:50236:14: note: in expansion of macro 'SSL_CTX_set_tmp_dh'
   { result = SSL_CTX_set_tmp_dh(x0, x1); }
              ^~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_CTX_set_tmp_ecdh':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1154:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:50249:10: note: in expansion of macro 'SSL_CTX_set_tmp_ecdh'
   return SSL_CTX_set_tmp_ecdh(x0, x1);
          ^~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_CTX_set_tmp_ecdh':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:1154:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_ECDH,0,(char *)ecdh)
  ^
build/temp.linux2-2.7/_openssl.c:50289:14: note: in expansion of macro 'SSL_CTX_set_tmp_ecdh'
   { result = SSL_CTX_set_tmp_ecdh(x0, x1); }
              ^~~~~~~~~~~~~~~~~~~~
In file included from build/temp.linux2-2.7/_openssl.c:717:0:
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_get_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:594:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:52093:10: note: in expansion of macro 'SSL_get_mode'
   return SSL_get_mode(x0);
          ^~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_get_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:594:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)
         ^
build/temp.linux2-2.7/_openssl.c:52116:14: note: in expansion of macro 'SSL_get_mode'
   { result = SSL_get_mode(x0); }
              ^~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_get_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:581:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)
         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:52129:10: note: in expansion of macro 'SSL_get_options'
   return SSL_get_options(x0);
          ^~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_get_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:581:9: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)
         ^
build/temp.linux2-2.7/_openssl.c:52152:14: note: in expansion of macro 'SSL_get_options'
   { result = SSL_get_options(x0); }
              ^~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_set_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:592:31: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
                               ^
build/temp.linux2-2.7/_openssl.c:53817:10: note: in expansion of macro 'SSL_set_mode'
   return SSL_set_mode(x0, x1);
          ^~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:592:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:53817:10: note: in expansion of macro 'SSL_set_mode'
   return SSL_set_mode(x0, x1);
          ^~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_set_mode':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:592:31: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
                               ^
build/temp.linux2-2.7/_openssl.c:53850:14: note: in expansion of macro 'SSL_set_mode'
   { result = SSL_set_mode(x0, x1); }
              ^~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:592:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
  ^
build/temp.linux2-2.7/_openssl.c:53850:14: note: in expansion of macro 'SSL_set_mode'
   { result = SSL_set_mode(x0, x1); }
              ^~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_d_SSL_set_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:577:34: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
                                  ^
build/temp.linux2-2.7/_openssl.c:53863:10: note: in expansion of macro 'SSL_set_options'
   return SSL_set_options(x0, x1);
          ^~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:577:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c:53863:10: note: in expansion of macro 'SSL_set_options'
   return SSL_set_options(x0, x1);
          ^~~~~~~~~~~~~~~
build/temp.linux2-2.7/_openssl.c: In function '_cffi_f_SSL_set_options':
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:577:34: warning: conversion to 'long int' from 'long unsigned int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
                                  ^
build/temp.linux2-2.7/_openssl.c:53896:14: note: in expansion of macro 'SSL_set_options'
   { result = SSL_set_options(x0, x1); }
              ^~~~~~~~~~~~~~~
/home/pepe/work/turrisos/turris1x-hbk/build/staging_dir/host/include/openssl/ssl.h:577:2: warning: conversion to 'long unsigned int' from 'long int' may change the sign of the result [-Wsign-conversion]
  SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
  ^
build/temp.linux2-2.7/_openssl.c:53896:14: note: in expansion of macro 'SSL_set_options'
   { result = SSL_set_options(x0, x1); }
              ^~~~~~~~~~~~~~~
error: command 'ccache_cc' failed with exit status 1
make[2]: *** [Makefile:82: /home/pepe/work/turrisos/turris1x-hbk/build/build_dir/target-powerpc_8540_musl/python-cryptography-2.1.4/.built] Error 1

[commodo]

i'll try to take a look
maybe we just need to update openssl?

[BKPepe]

I was able to compile it locally with this commit BKPepe@cb42523 , which I've pushed to Turris build bots, so let's see.

[commodo]

ack
thanks for the quick-find :)

[jefferyto]

Would it be better if we updated cryptography to 2.3 (or 2.3.1)? pyca/cryptography#4234 was subsumed by pyca/cryptography#4270, which according to the changelog should be in 2.3. Also 2.3 has a fix for a security issue (CVE-2018-10903).

@BKPepe I think BKPepe/packages@cb42523 is from pyca/cryptography#4270?

[jefferyto]

Actually I'm ok with backporting patches for both issues as well if it's not too difficult.

[BKPepe]

@jefferyto yes, the commit is from the pr, but yeah we can update it to 2.3.1.

[jefferyto]

Hmm now I'm leaning more towards just backporting patches 😂 we should keep 18.06 as frozen as possible.

[jefferyto]

@BKPepe I think pyca/cryptography#4342 is the fix for the security issue - would you mind trying/adapting the patch? Then we can include both patches and increment PKG_RELEASE only once.

[BKPepe]

I will try.

[BKPepe]

Ok, the patch (BKPepe@c6f626d) applies without a hassle, but I would like to run test both things before I sent a PR.

[jefferyto]

@BKPepe Thanks for your quick action on this 😄

[neheb]

@BKPepe That issue in the beginning looks like you have OpenSSL 1.1.0 in staging_dir while python-cryptography with that version does not support it.

[BKPepe]

@neheb This issue appeared since an update of Python2 in openwrt-18.06 branch locally and Turris build bots. I'm pretty sure that this is going to happen also on OpenWrt build bots. When I reverted Python update, it works for me. As patch works for compilation, I'm fine with that. However, I didn't run tested it, yet.

[neheb]

Just looked again. It seems that commit is correct. LibreSSL is used in tools, and hence host:

/builder/shared-workdir/build/sdk/staging_dir/host/include/openssl/x509.h:919:6: note: previous declaration of 'X509_get0_signature' was here
 void X509_get0_signature(const ASN1_BIT_STRING **psig,

Which reminds me of a false dependency of one other package...

[jefferyto]

OpenWrt buildbots hit these errors as well, e.g. mips_24kc, arm_cortex-a5_neon-vfpv4